CVE-2021-44964

low-risk

Published 2022-03-14

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.

Do I need to act?

0.26% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.3/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Lua

Affected Vendors

Lua

References (10)

Exploit http://lua-users.org/lists/lua-l/2021-11/msg00186.html

Exploit http://lua-users.org/lists/lua-l/2021-12/msg00007.html

Mailing List http://lua-users.org/lists/lua-l/2021-12/msg00015.html

Mailing List http://lua-users.org/lists/lua-l/2021-12/msg00030.html

Exploit https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability

Exploit http://lua-users.org/lists/lua-l/2021-11/msg00186.html

Exploit http://lua-users.org/lists/lua-l/2021-12/msg00007.html

Mailing List http://lua-users.org/lists/lua-l/2021-12/msg00015.html

Mailing List http://lua-users.org/lists/lua-l/2021-12/msg00030.html

Exploit https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability

/ 100

low-risk

Severity 20/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal